binnacle

• summary() — how much is stored and the span it covers, for one user or for the whole device. Enough to tell someone what is kept about them without reading the recording itself.
• forget() now takes a userKey. Without one it still drops everything, which on a phone two people share is more than the one asking is entitled to erase.
• currentUserKey — who the session being recorded belongs to, so an app showing someone their own recording does not have to look them up again.

• A field named after a JSON web token — jwt, mobile_jwt, anything with jwt in it — is now hidden like any other credential. It was being written down whole.

• BinnacleConfig.sensitiveKeys — names an app knows carry a secret, hidden wherever they turn up. Passwords, tokens and card numbers are recognised already; this is for the fields whose name means nothing to an outsider and everything to the app. What an app declares joins what is hidden by default rather than replacing it.

First release. Records on the device and hands the recording over on demand.

• Sessions, with the rules for cold starts, long stays in the background, processes that were killed, signing out and sessions that run too long.
• Navigation from a navigator observer, from a router, or reported by an app that already funnels its own navigation.
• HTTP through a dio interceptor, or reported call by call for clients no interceptor can reach.
• Sanitization before anything reaches the disk: bodies only for the app's own API, recursive redaction by key, and routes an app can declare sensitive so nothing but the visit is kept while one is on screen.
• Buffered writes into sqflite, with retention, degradation under pressure and recording that gives up quietly rather than take an app down with it.
• exportBatch() for reading a recording, and forget() for dropping it.
• No-op on the web, where there is no database to record into.

The uploader — the protocol that asks a backend whether it wants the recording and sends it — is not in this release.